c0e2fe2e12
MEDIUM-002: Remove manual X-Forwarded-For parsing in metrics_protection.go, use c.ClientIP() only (respects SetTrustedProxies) MEDIUM-003: Pin ClamAV Docker image to 1.4 across all compose files MEDIUM-004: Add clampLimit(100) to 15+ handlers that parsed limit directly MEDIUM-006: Remove unsafe-eval from CSP script-src on Swagger routes MEDIUM-007: Pin all GitHub Actions to SHA in 11 workflow files MEDIUM-008: Replace rabbitmq:3-management-alpine with rabbitmq:3-alpine in prod MEDIUM-009: Add trial-already-used check in subscription service MEDIUM-010: Add 60s periodic token re-validation to WebSocket connections MEDIUM-011: Mask email in auth handler logs with maskEmail() helper MEDIUM-012: Add k-anonymity threshold (k=5) to playback analytics stats LOW-001: Align frontend password policy to 12 chars (matching backend) LOW-003: Replace deprecated dotenv with dotenvy crate in Rust stream server LOW-004: Enable xpack.security in Elasticsearch dev/local compose files LOW-005: Accept context.Context in CleanupExpiredSessions instead of Background() LOW-002: Noted — Hyperswitch version update deferred (requires payment integration tests) 29/30 findings remediated. 1 noted (LOW-002). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
81 lines
2.6 KiB
YAML
81 lines
2.6 KiB
YAML
name: Load Tests (Nightly)
|
|
|
|
on:
|
|
schedule:
|
|
- cron: '0 2 * * *'
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
load-test:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
|
|
- name: Install k6
|
|
run: |
|
|
sudo gpg -k
|
|
sudo gpg --no-default-keyring --keyring /usr/share/keyrings/k6-archive-keyring.gpg --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys C5AD17C747E3415A3642D57D77C6C491D6AC1D69
|
|
echo "deb [signed-by=/usr/share/keyrings/k6-archive-keyring.gpg] https://dl.k6.io/deb stable main" | sudo tee /etc/apt/sources.list.d/k6.list
|
|
sudo apt-get update && sudo apt-get install -y k6
|
|
|
|
- name: Start infrastructure
|
|
run: |
|
|
docker-compose -f docker-compose.yml up -d postgres redis rabbitmq
|
|
sleep 15
|
|
|
|
- name: Set up Go
|
|
uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
|
|
with:
|
|
go-version: "1.24"
|
|
cache: true
|
|
|
|
- name: Run migrations
|
|
working-directory: veza-backend-api
|
|
env:
|
|
DATABASE_URL: postgresql://veza:devpassword@localhost:15432/veza?sslmode=disable
|
|
REDIS_URL: redis://localhost:16379
|
|
JWT_SECRET: test-jwt-secret-for-load-test
|
|
APP_ENV: test
|
|
run: |
|
|
go mod download
|
|
go run cmd/migrate_tool/main.go || true
|
|
|
|
- name: Start backend API
|
|
working-directory: veza-backend-api
|
|
env:
|
|
DATABASE_URL: postgresql://veza:devpassword@localhost:15432/veza?sslmode=disable
|
|
REDIS_URL: redis://localhost:16379
|
|
RABBITMQ_URL: amqp://veza:devpassword@localhost:15672/
|
|
JWT_SECRET: test-jwt-secret-for-load-test
|
|
APP_ENV: test
|
|
PORT: 8080
|
|
run: |
|
|
go run cmd/api/main.go &
|
|
sleep 15
|
|
|
|
- name: Wait for backend
|
|
run: |
|
|
for i in 1 2 3 4 5 6 7 8 9 10; do
|
|
if curl -sf http://localhost:8080/health; then
|
|
echo "Backend ready"
|
|
exit 0
|
|
fi
|
|
sleep 3
|
|
done
|
|
echo "Backend not ready"
|
|
exit 1
|
|
|
|
- name: Run smoke load test
|
|
run: k6 run loadtests/smoke.js
|
|
|
|
- name: Run backend load test
|
|
run: |
|
|
k6 run --out json=load-results.json loadtests/backend/full.js || true
|
|
continue-on-error: true
|
|
|
|
- name: Upload results
|
|
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
|
|
with:
|
|
name: load-test-results
|
|
path: load-results.json
|
|
if: always()
|